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Abstract. Many problems in additive number theory, such as Fermat's last theorem 
and the twin prime conjecture, can be understood by examining sums or differences of 
a set with itself. A finite set A C Z is considered sum-dominant if |A+v4| > \A— A\. If 
we consider all subsets of {0, 1, . . . , n— 1}, as n — > oo it is natural to expect that almost 
all subsets should be difference-dominant, as addition is commutative but subtraction 
is not; however, Martin and O' Bryant in 2007 proved that a positive percentage are 
sum-dominant as n — s- oo. 

This motivates the study of "coordinate sum dominance". Given V C (Z/nZ) 2 , we 
call S :— {x + y : (x, y) £ V} a coordinate sumset and D := {x — y : (x, y) £ V} a 
coordinate difference set, and we say V is coordinate sum dominant if \S\ > \D\. An 
arithmetically interesting choice of V is #2 (a; n), which is the reduction modulo n of 
the modular hyperbola H^a; n) := {(x, y) : xy = a mod n, 1 < x, y < n}. In 2009, 
Eichhorn, Khan, Stein, and Yankov determined the sizes of S and D for V = ^(l; n) 
and investigated conditions for coordinate sum dominance. We extend their results to 
reduced d-dimensional modular hyperbolas Hd(a; n) with a coprime to n. 
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1. INTRODUCTION 

Let A C NU {0}. Two natural sets to study are 

A + A = {x + y : x,y E A} 

A- A = {x-y:x,yeA}. (1.1) 

The former is called the sumset and the latter the difference set. Many problems in 
additive number theory can be understood in terms of sum and difference sets. For 
instance, the Goldbach conjecture says that the even numbers greater than 2 are a subset 
of P + P, where P is the set of primes. The twin prime conjecture states that there are 
infinitely many ways to write 2 as a difference of primes (and thus if Pjy is the set of 
primes exceeding N, Pn — Pn always contains 2). If we let A n be the set of positive 
n th powers, then Fermat's Last Theorem says (A n + A n ) D A n = for all n > 2. 

Let \S\ denote the cardinality of a set S. A set A is sum dominant if \A + A\ > 
\A — A\. We might expect that almost all sets are difference dominant since addition 
is commutative while subtraction is not. However, in 2007 Martin and O'Bryant HMOl 
proved that a positive percentage of sets are sum dominant; i.e., if we look at all subsets 
of {0, 1, . . . , n — 1} then as n — > oo a positive percentage are sum dominant. One 
explanation is that choosing A uniformly from {0,l,...,n — 1} is equivalent to taking 
each element from to n — 1 to be in A with probability 1/2. By the Central Limit 
Theorem this implies that there are approximately n/2 elements in a typical A, yielding 
on the order of n 2 /4 pairs whose sum must be one of 2n — 1 possible values. On 
average we thus have each possible value realized on the order of n/8 ways. It turns 
out most possible sums and differences are realized (the expected number of missing 
sums and differences are 10 and 6, respectively). Thus most sets are close to being 
balanced, and we just need a little assistance to push a set to being sum-dominant. 
This can be done by carefully controlling the fringes of A (the elements near and 
n — 1). Such constructions are the basis of numerous results in the field; see for example 
II1LMZI IMOl IMOSl IMPEL IZhTl IZh2l . 

This motivates the study of "coordinate sum dominance" on fringeless sets such as 
(Z/nZ) 2 . Given V C (Z/nZ) 2 , we call S := {x + y : (x, y) G V} a coordinate 
sumset and D := {x — y : (x,y) E V} a coordinate difference set, and we say V is 
coordinate sum dominant if l^l > \D\. An arithmetically interesting choice of V is 
H 2 (a] n), which is the reduction modulo n of the modular hyperbola 

H 2 (a; n) := {(x, y) : xy = a mod n, 1 < x,y < n}, (1.2) 

where (a,n) = 1. Eichhorn, Khan, Stein, and Yankov |HKSY| determined the cardi- 
nalities of S and D for V = H 2 (l;n) and investigated conditions for coordinate sum 
dominance. See HMVII for additional results on related problems in other modular set- 
tings. 

The modular hyperbolas in (11.21 ) have very interesting structure, as is evidenced in 
Figured] See Figures 1 through 4 of IEKSYII for additional examples. 

In the sequel, coordinate sumsets will be the only type of sumset discussed. Hence 
we may drop the premodifier "coordinate" without fear of confusion. For a relatively 
prime to n, we define the sumset S 2 (a; n), the difference set D 2 (a; n), and their reduced 
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counterparts as 

S 2 (a;n) = {x\ + x 2 : (zi, x 2 ) G H 2 (a; n)} 

D 2 (a;n) = {x\ — x 2 : (xi, x 2 ) G H 2 (a; n)} 

S 2 (a;n) = {x± + x 2 mod n : (xi, x 2 ) G H 2 (a; n)} 

D 2 (a;n) = {xi — x 2 mod n : (x\,x 2 ) <E H 2 (a;n)}. (1.3) 

From a geometric viewpoint, #S 2 (a; n) counts the number of lines of slope —1 that 
intersect #2(0; w)> and #D 2 (a; n) counts the number of lines of slope 1 that intersect 
H 2 (a; n). When the ratio 

c 2 (a;n) := #S 2 (a;n)/#D 2 (a;n) (1.4) 

exceeds 1, we have sum-dominance of H 2 (a; n). 
A (i-dimensional modular hyperbola is of the form 

H d (a; n) := {(x u . . . , x d ) : x ± ■ ■ ■ x d = a mod n, 1 < x t , . . . , x d < n}, (1.5) 

where (a, n) = 1. We define the generalized signed sumset as 

Sd(m; a; n) = {xi H V x m x d mod n : (xi,...,x d ) G #d(a; n)}, (1.6) 

where m is the number of plus signs in ±x\ ± • ■ • ± x d . In particular, S 2 (l;a;n) = 
D 2 (a; n) and 5*2(2; a; n) = S 2 (a; n). 

The goal of this paper is to extend results of [EKSYj to the general two-dimensional 
modular hyperbolas in (11.21 ). and to investigate the higher dimensional modular hyper- 
bolas defined in (11.51) . We prove explicit formulas for the cardinalities of the sumsets 
S 2 (a;n) and difference sets D 2 (a;n) (Theorems 13.31 and I3.61 ). This allows us to an- 
alyze the ratios c 2 (a; n) (Theorems 13.81 - I3T21 ), thus providing conditions on a and n 
for sum dominance and difference dominance of reduced modular hyperbolas H 2 (a; n) . 
For example, a special case of Theorem 13.91 shows that if a = 11 and n = 3*7 S with 
t > 2, then c 2 (a; n) > 1, i.e., we have sum dominance. A special case of Theorem 13 .121 
shows that when a is a fixed power of 4, we have sum dominance for more than 85% 
of those n relatively prime to a. For d > 2 and positive integers n whose prime factors 
all exceed 7, we prove in Theorem 14. II that #Sd(m; a; n) = n. This means that each 
such generalized sumset consists of all possible values mod n, i.e., all possible sums 
and differences occur. 
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2. Counting Preliminaries 

In this section we present some counting results that are central to proving our main 
theorems. Many of these are natural generalizations of results from HEKSYH . so we 
refer the reader to the appendix for detailed proofs. 

Throughout this paper, p always denotes a prime. The following proposition reduces 
the analysis of the cardinalities of Sd(m; a; n) to those of Sd(m; a;p*), where p l is a 
factor in the canonical factorization of n. 

Proposition 2.1. Let n = Yli=i pi* be the factorization ofn into distinct prime powers. 
Then 

k 

#5 d (m; a; n) = JJ #S d {m\ a;p?). (2.1) 
i=i 

The proof is given in Appendix lA.il 

Lemma [2T2l cuts our work in half, as once we understand the sumset we immediately 
have results for the corresponding difference set. 

Lemma 2.2. We have S 2 (a; n) = D 2 (—a;n). 

Proof. We show S 2 (a; n) C D 2 (—a; n); the reverse containment is handled similarly. 
Let r e S 2 (a; n). Then there exists (x , yo) G H 2 (a; n) such that x y = a mod n and 
xq + y = r mod n. Since (xq, n — y ) G H 2 (—a; n) and r = xq — (n — yo) mod n, 
we see that r G D 2 (—a; n). □ 

Lemma 2.3. Wfe /?ave (2k mod p') G D 2 (a;p t ) <^ (A; 2 + a) w a square modulo p l . The 
map f(k) = 2k mod p l defines a bijection 

f : {k : k 2 + a is a square mod p\0 < k < p 1 } — > D 2 (a;p t ) (2.2) 

w/zen p > 2. T/'p = 2, / defines a bijection 

f : {k : k 2 + aisa square mod 2*, < fe < 2*" 1 } -> Z) 2 (a; 2*). (2.3) 

See Appendix IA.21 By Lemma 2.2, a similar result for S in place of D follows by 
replacing a by —a. 

3. CARDINALITIES OF S 2 (a]p l ) AND D 2 (a]p l ) 

In this section we compute the cardinalities of S 2 (a; p l ) and D 2 (a; p*). We then give 
conditions on a and n for sum dominance and difference dominance of H 2 (a; n). 

3.1. Case 1: p = 2. We isolate a useful result that we need for the proof of the next 
lemma. 

Proposition 3.1 (Gauss UGalO . Fort > 1, any integer of the form 4 fc (8n+ 1) is a square 
mod 2*. 

The next result is used in investigating some of the cases of Theorem 13 .3 1 

Lemma 3.2. Write m = 4b + r with < r < 3. For t > 5, k 2 + 3 + 8m is a 
square mod 2* if and only ifk = ±(4r + 1) mod 16. 
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Proof. We only prove the case r = 0, as the other proofs are similar. First assume 
that k 2 + 3 + 8m is a square mod 2 l . Reducing mod 32, we have that k 2 + 3 + 8m = 
k 2 +3 mod 32, which implies that A; = ±1 mod 16. Conversely, assume that A; = 16/±1 
for some / E Z. Then k 2 + 3 + 8m = (16/ ± l) 2 + 3 + 8(46) = 256/ 2 ± 32/ + 4 + 
32b = 4(8(8/ 2 ±l + b) + l) mod 2*. Hence, by Proposition |3J] k 2 + 3 + 8m is a 
square mod 2*. □ 

Theorem 3.3. For t > 5, 



Moreover, #5*2(0; 16) = 2 for all a, and when t < 3, we have #£2(0; 2*) = 1 wz'm me 
exception that #5*2(0; 8) = 2 vv/zen a = 1 mod 4. 

Proof. The claim for £ < 4 can be checked by direct calculation, so assume t > 5. By 
Lemma [2721 it is enough to prove the claims about the cardinality of D 2 (a; 2') when 
a = 1, 3, 5 mod 8 and £2(0; 2*) when a = 1 mod 8. 

We refer to the Appendix IA.3l for the proofs of the results for D 2 (a; 2*) when a = 
1, 5 mod 8 and for §2 (a; 2*) when a = 1 mod 8, since these proofs are straightforward 
generalizations of proofs in HEKSYH . 

It remains to prove the result for the difference set when a = 3 mod 8. Write a = 3 + 
8m. We consider only the case where m = mod 4, since the cases m = 1,2,3 mod 4 
are proved similarly and lead to the same result. By Lemma 13.21 we see that if m = 
mod 4, then 

#{A; : k 2 + 3 + 8m is a square mod 2*, < k < 2*" 1 } 



= #{1 + 16/ : < / < 2*~ 5 } + #{15 + 16/ : < / < 2^} = 2 l ~\ (3.2) 
By Lemma [231 we know 

#L>(a; 2') = #{/c : A; 2 + 3 + 8m is a square mod 2\ < k < 2*" 1 }. (3.3) 



3.2. Case 2: p > 2. For this subsection, we adopt the following notation from HEKSYH : 

5*2(0; p l ) = {k mod p l : A; 2 — a is a square mod p l , p \ (k 2 — a)} 
5 2 '(a;p*) = {k mod p l : k 2 — a is a square mod p*, p\(k 2 — a)} (3.4) 

By Lemma l2~3l 




(3.1) 



Hence#L> 2 (o;2') = 2 



□ 



#£2(0; p 4 ) 



= #5 2 (o;p t ) + #5 2 / (o;/) 



(3.5) 
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Lemma 3.4. Let p be an odd prime. Then 



(p-3)p t 



-1 
1. 



(3.6) 



See Appendix IA.4I for the proof. 

Lemma 3.5. Let p be an odd prime. If 

#5 2 (a;p*) = ^.Jjr(j 



■1, ?/zen #S r 2(a;j?) = and f/iKS 



1. 



p 



t-i 



p 



3 
2 



(P 



2(P 



(3.7) 



See Appendix I A . 5 1 for the proof. 
Theorem 3.6. For t > 1 and p > 2, 



+ 



2 

f (p-3)p« 
2 

2 

2 

tip*) 
2 



+ 



P+l 



p+l ^ 2 ^ 



(-l)t-i(p-l) 
2(P+1) 



2(P+1) 



(-l)*-i(p-l) 
2(p+l) 



P 
P 
P 



= -1 

1 mod 4, 
1 mod 4, 
3 mod 4, 



p = 3 mod 4, ( - 



-1 
-1 
1. 

(3.8) 

□ 



Proof. The result follows from Lemmas 13.41 13.51 and 12.21 
Corollary 3.7. Forp = 1 mod 4, c 2 (a;p k ) = 1. 

3.3. Ratios for d — 2. Now that we have explicit formulas for the cardinalities of 
the sum and difference sets, the next natural object to study is the ratio c 2 (a; n) of the 
size of the sumset to the size of the difference set. By Corollary 13.71 we only need to 
consider the prime factors of n which are congruent to 3 mod 4, since the primes which 
are congruent to 1 mod 4 do not change 02(0; n). When p = 3 mod 4, it is sufficient 

= 1, since c 2 (— a;p') is the reciprocal of 



to evaluate c 2 (a;p*) in the case when 

c 2 (a;p*). 

Theorem 3.8. Forp = 3 mod 4 and = 1, 



[t/2]-l 



c 2 (a;p 



!" 2 £ 



8=0 



P 



2i+l 



+ 



0(pT 



(3.9) 
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Proof. By Theorem 13 .61 

c 2 (a;p) = = h 



Therefore, 

c 2 (a;p t ) - 1 - 



2 p+1 2 2(p+l) / 0(p*)/2 

p 2 -2p-l (-l)*" 1 ^- 1) + 3p + 3 
p 2 - 1 + (p+l)0(p*) ' 

2 -2p (-l)*- 1 ^- 1) + p + 1 



(3.10) 



0(p*) P 2 - 1 (p + l)0(p*) 

2 °° 1 [ * /2]-1 1 



F [i/2] F i=0 F 



□ 



Theorem 3.9. Le? p < q be primes, both congruent to 3 mod 4, and let s, t > 2. Tfa 
?5 a square mod p, f/zen C2(a; p t q s ) < 1, so we have difference dominance. If a is not a 
square mod p, then C2(a; p t q s ) > 1, so we have sum dominance. 

Proof. It suffices to prove the first assertion, for then the second will follow by taking 
the reciprocal. By Theorem 13.81 C2(a;p t ) < 1. If a is a square mod q, then also 
c 2 (a; q s ) < 1, so that c 2 (a;p t q s ) = c 2 (a;p*)c 2 (a; q s ) < 1, as desired. Finally, assume 
that a is not a square mod q. Then it remains to show that C2(— a; q s ) > C2(a;p t ). By 
Theorem 13 .81 C2(a;p t ) is monotone decreasing in t. Therefore it suffices to show that 
Hindoo c 2 (— a; q s ) > c 2 (a;p 2 ). This inequality is equivalent to 1 — 2q/(q 2 — 1) > 
1 — (2p — 4:)/(p 2 — p), so we must show that (p — 2)/(p 2 — p) > q/(q 2 — 1). Since 
the right member is a decreasing function of q, it suffices to prove this inequality when 
q = p + 4, and this is easily accomplished. □ 

It is not hard to show that the conclusion of Theorem 13 .9 1 still holds in the case s — 1, 
t > 2. However, the inequalities are reversed in the case t — 1, s > 1. 

The next three theorems are straightforward generalizations of results from HEKSYI . 
so we omit the proofs. 

Theorem 3.10. Let Nk = nf=i Pi> where pi is the i th prime that is congruent to 3 
modulo 4. Fix a perfect square a relatively prime to all of the pi. Then 

c 2 (a;N k ) x loglogiV fc , (3.12) 

and for any t > 2, 

c 2 {a-Nl) x (log log A^- 1 . (3.13) 

Theorem 3.11. Fix an integer a. Let n run through the positive integers relatively prime 
to a. Then 

(1) 

- — < c 2 (a;n) < log log n, (3.14) 

log log n 

(2) 

lim sup c 2 (a;n) = oo and lim inf c 2 (a;n) = 0, (3.15) 
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(3) 



hm sup r = oo and lim ml r = 0. (3.16) 



Theorem 3.12. For a fixed nonzero integer a, let E a denote the set of positive integers 

n relatively prime to a such that = 1 for every prime p = 3 mod 4 dividing n. 

Let C a (L) = {n £ E a : C2(a;n) > L}. Define E a (x) = {n £ E a : n < x} and 
C a (L, x) = {n £ C a (L) : n < x}. Then the lower density ofC a (L) in E a , defined by 
liminf #C a (L, x)/#E a (x), satisfies the inequality 

* CM >K^-\), (3-17) 



where the product is over all primes p = 3 mod 4 for which ( - ) =1, and where 



K a 



(3.18) 



. v , 

1 a = mod 2 

63/64 a = 1 mod 8 
31/32 a = 5mod8 
15/16 a = 3 mod 4. 

Furthermore, for any constant L > 0, lower density ofC a (L) in E a is positive. 

For example, if a is an odd power of 2, then the lower density in (13.171 ) exceeds 97%. 

Note that if the condition = 1 is replaced by = — 1 throughout the statement 

of Theorem 13.121 then by Lemma [2T2l (13.171) holds with the inequality C2(a;n) > 1 
replaced by 02(0; n) < 1. 



4. CARDINALITY OF S d (m; a; n) FOR d > 2 

We now turn our attention to modular hyperbolas with higher dimension (d > 2). 
Suppose that p > 7 for every prime p dividing n. Then Theorem 14.11 shows that the 
higher dimensional generalized sumsets Sd(m; a; n) all have cardinality n. In particular, 
this cardinality is the same for every value of m, i.e., there is no dependence on the 
number of plus and minus signs. 

Theorem 4.1. If the prime factors ofn all exceed 7, then ^Sd(m; a; n) = n. 

Proof. Let q = p t for a prime p > 7. By Proposition 12.11 it suffices to prove that 
#Sd(m; a; q) = q. We will show that for every a coprime to q and every b mod q, the 
system of congruences 

X\ + • • • + Xd = b mod q 

X\---Xd = a mod q (4.1) 

has a solution. This suffices, because X{ could be replaced by q — x.- t for any collection 
of subscripts i. If (14.11) can always be solved for d = 3, then it can always be solved for 
any d > 3, by setting Xj = 1 for i > 3. Thus assume that d = 3. 
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Solving (14.11) is equivalent to solving the congruence xy(b — x — y) = a mod q for 
x,y E (Z/gZ)*. Replacing y by y _1 and then multiplying by y, we see that this is 
equivalent to solving 

x 2 + x(y^ — b) + ay = mod g. (4.2) 
The quadratic polynomial in x in (14.21) has discriminant 

(-4ay 3 + 6V-26y+l)/y 2 . (4.3) 

Let R(y) E (Z/pZ)[y] denote the cubic polynomial in y obtained by reducing the nu- 
merator in (14.31 ) mod p. To solve (14.21 ), it remains to show that there exists y E (Z/pZ)* 
for which -R(y) is a non-zero square mod p; this is because a non-zero square mod p 
is also a square mod g (see p. 46 of lURl ). 

Suppose for the purpose of contradiction that no term in the sum 

p-i 

(4.4) 



is equal to 1. Then since R(y) has at most 3 zeros in (Z/pZ)*, we have 



i/=o 



for some w E {1, 2, 3, 4}. 

Let D denote the discriminant of -R(y). Then .D = 16a(6 3 — 27a) modp, and so 
L> vanishes if and only if a = (6/3) 3 mod p. When D vanishes, it follows that b E 
(Z/pZ)* and y = 3/(46) is a simple zero of R(y). We conclude that R(y) cannot equal 
a constant times the square of a polynomial in (Z/pZ)[y). Therefore (see equation 
(6.0.2) in HBEWH ) we can apply Weil's bound to conclude that \S\ < 2y/p. Together 
with (1431) . this yields 

p - 2^P < w < 4, (4.6) 
which contradicts the fact that p > 7. □ 

We remark that the conditions p > 7 cannot be weakened in Theorem 14.11 For 
example, (14.21) has no solution when p = q = 2, b = and a — 1; when p = q = 3 and 
b = a = 1; when p = q = 5, 6=1 and a = 2; and when p = q = 7,b = and a = 3. 

5. Conclusion and Future Research 

We generalized work of HEKSYII on the modular hyperbola H 2 (l, n) by examining 
more general modular hyperbolas Hd(a;n). The two-dimensional case (d = 2) pro- 
vided interesting conditions on a and n for sum dominance and difference dominance. 
On the other hand, for higher dimensions (d > 2), all possible sums and difference are 
realized when the prime factors of n all exceed 7. 

The following are some topics for future and ongoing research: 

(1) We can study the cardinality of sumsets and difference sets of the intersection 
of modular hyperbolas with other modular objects such as lower dimensional 
modular hyperbolas and modular ellipses. See HHKI for work on the cardinality 
of the intersection of modular circles and H 2 (l;n). 
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(2) Extend Theorem 13 .9l by estimating 02(0; n) in cases where n has more than two 
prime factors of the form Ak + 3. 

(3) Extend Theorem |4.1| by finding the cardinality of the generalized higher dimen- 
sional sumsets in cases where (n, 210) > 1. 

(4) In higher dimensions (d > 2), nearly every sum and difference is realized for 
H d (a; n). The situation becomes more interesting if we replace H d (a; n) by a 
random subset chosen according to some probability distribution depending on 
d. If S and D denote the corresponding sumset and difference set, we can then 
compare the random variables #S and j^D. 

Appendix A. Additional Proofs 

The following proofs are a natural extension of the proofs given by HEKSYL and are 
included for completeness. 

A . 1 . Proof of Proposition 12.11 

Proof of Proposition \2.1\ Consider 

k 

g : S d (m;a;n) — > Y]_S d (m; a mod ;pf) (A.l) 

i=l 

defined by 

g(x) = (imodpjV-.^modp^). (A.2) 

We claim g is a bijection. 

To show g is injective, suppose g(x) = g(y). Then we have (x mod pi 1 , . . . , x mod 
Pk) = (v m °d Pi 1 i ■ ■ ■ > V mod p e k k ) =>- x = y mod p^ for % — 1, . . . , k. Thus, by the 
Chinese Remainder Theorem, we have that x = y mod n. But 0<x,y<n^-x = y, 
so g is injective. 

To show g is surjective, let (a 1} . . . , a k ) G EliLi ^l 771 ! a m °d pT'iPT)- Then, for 

each i G {1, . . . , k}, there exists {x lt , . . . , x di ) G H d (a; p^) such that xi i H h x mi — 

■ — x di = oii mod pl\ By the Chinese Remainder Theorem, the system of congruences 

x r = x r4 mod p^ (A.3) 

where 1 < r < d has a unique solution xi = x[,...,x d = x' d modn. Since 
Xi t ■ ■ ■ x di = a mod p^ for all i G {1, ... , k}, we have, again by the Chinese remainder 
theorem, x[ ■ ■ ■ x' d = a mod n. So g(xl H — • + x' m — ■ ■ ■ — x' d mod n) = (a±, . . . , ak), 
and hence g is a bijection, which completes the proof. □ 

A.2. Proof of Lemma [2731 Before proving Lemma 1231 we state a useful lemma that 
is a simple observation and immediate generalization of a result from HEKSYH . 

Lemma A.l. Let (xo,yo) G H 2 (a;p t ). Then x — yo = 2&i modp* and xq + y$ = 
2/^2 mod p* for some k\,k 2 G Z. 

Proof, lip = 2, then x and y are both odd since they are coprime to p l , so their sum 
and difference are even. If p ^ 2, then 2~ 1 exists mod p l , so x — yo = 2A; X mod and 
x + ?/o = 2^2 mod p l both have solutions. □ 
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Proof of Lemma [Ol Since the proofs are similar, we only prove (1). 

"=>■" Let (x ,y ) E H 2 (a;p t ). By Lemma lATl x — y = 2k mod p* for some 
k E Z. Note x — y G D 2 (a;p). Upon completing the square, we obtain k 2 + a = 
(x — k) 2 mod p*. Thus A; 2 + a is a square mod p*. 

"<£=" Suppose k 2 + a is a square mod p*. Then there exists c G Z such that c 2 — k 2 = 
a mod p*. It follows that (xo, j/o) = ((c + mod p 4 , (c — fc) mod p*) G #2(0; P*) and 
xo — yo = 2/c mod p*. 

Now we show that <i p i ja is a bijection. If p > 2, then (d p t >a ) _1 (x) = 2 _1 x mod p* is 
the inverse of d p t ja (x). 

Now suppose p = 2. We first show d p t a is injective. Choose k E Z such that 
< < 2* _1 and /c 2 + a is a square mod 2 t . Consider k\ = (k — 2*~ 1 ) mod 2*. Then 
k\ + a is also a square mod 2* (because k\ + a = k 2 + 2(2'~ 1 ) — 2*fc + a = k 2 + a 
mod 2*" 1 ). The congruence 2x = 2k mod 2* has exactly two distinct solutions, which 
must be k and k\. Since either k or fci is less than 2 t_1 , we conclude that g^v is 
injective. 

To show dpt a is surjective, let t E D 2 (a;2 t ). Then by Lemma [A. II there exists 
(^0) Vo) ^ -^2(0; 2*) such that x — y = t = 2k mod 2* for some k E Z. Hence, since 

t = 2k, d p t >a (k) =t. □ 

A. 3. Proof of Theorem l33l cases. The next proposition is from flTR] (see page 46). It 
gives us a quick way to count squares modulo prime powers. 

Proposition A.2. For the congruence 

x 2 = a mod p* 

where p w a prime and a is an integer such that p \ a, we have the following: 

(1) If p 7^ 2 and the congruence x 2 = a mod p solvable, then for every t > 1 
congruence x 2 = a mod p* «5 solvable with precisely two distinct solutions. 

(2) If p = 2 and the congruence x 2 = a mod 2 3 is solvable, then for every t > 3 
f/ze congruence x 2 = a mod 2* w solvable with precisely four distinct solutions. 

Proof of Theorem \33\ We break the analysis by the congruence class of a modulo 8. 

Case 1: Difference set for a = 1 mod 8. By Proposition [231 we know 

#D(a; 2 l ) = #{£; : k 2 + 1 + 8m is a square mod 2\ < fc < 2*" 1 }. (A.4) 
We claim that 

k 2 + 1 + 8m is a square mod 2* <^ k = Al for some / G Z. (A.5) 

"=>-" Assume k 2 + 1 + 8m is a square mod 2*. Then k 2 + 1 is a square mod 8, which 
yields = 0, 4 mod 8. Hence k = Al for some / G Z. 

"•£=" Assume = Al for some / G Z. We want to show A; 2 + 1 + 8m = (4/) 2 + 1 + 8m 
is a square mod 2*. Reducing modulo 8 gives us (4/) 2 + 1 + 8m = 1 mod 8, which is 
a square for all I. Hence, by the second part of Proposition IA.21 (4/) 2 + 1 + 8m is a 
square mod 2 t for all /. Thus 

{k : k 2 + 1 + 8m is a square mod 2*, < k < 2^} = {Al : < / < 2*~ 3 }. (A.6) 
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Case 2: Difference set for a = 5 mod 8. Using a similar argument from above, we show 
that 

k 2 + 5 + 8m is a square mod 2* <^> k = 2 + 4Z for some/ G Z. (A.7) 

"=>" Assume A; 2 + 5 + 8m is a square mod 2*. Then A; 2 + 5 + 8m = k 2 + 5 is a square 
mod 8, which implies A; = 2, 6 mod 8 or k = 2 + 4Z for some / G Z. 

"-<=" Assume A; = 2 + 4/ for some Z G Z. Reducing modulo 8 gives us (2 + 4/) 2 + 
5 + 8m = 4 + 16/ + 16Z 2 + 5 + 8m = 1 mod 8, which is a square for all Z. Hence, by 
the second part of Proposition IA.21 (4/) 2 + 1 + 8m is a square mod 2* for all /. Since 
k = 2 + 4Z and < k < 2*" 1 we have < Z < 2*~ 3 . Hence 

{k : k 2 + 1 + 8m is a square mod 2*, < k < 2*" 1 } = {4/ : < I < 2*" 3 }. (A.8) 



Case 3: Sum set for a = 1 mod 8. Assume a = 1 mod 8. Thus a = 1 + 8t for some 
t G Z. We show that 

#{£; : A; 2 - 1 - St is a square mod 2 4 , < fc < 2*" 1 } = 2#{A; 2 mod 2*~ 4 }. (A.9) 

Let j G {A; : A; 2 - 1 - 8t is a square mod 2*, < A; < 2* -1 }. So j 2 - 1 - 8t is a 
square mod 2*. Note that j = 21+ 1 because if not, we can reduce mod 4 and notice that 
— 1 is a square mod 4, which is a contradiction. Also, (I 2 + 1 — 2t) is a square mod 2'~ 2 . 
Hence 

{k : A; 2 - 1 - 8t is a square mod 2*, < fc < 2^} 

= #{/ : / 2 + / - 2t is a square mod 2*" 2 , < I < 2'~ 2 }. (A. 10) 

As 

#{Z : / 2 + / - 2t is a square mod 2^ 2 , < fc < 2*~ 2 , 1 even} 

= #{/ : / 2 + /-2tisasquaremod2*- 2 ,0</<2'~ 2 ,/odd}, (A. 11) 

we find 

#{Z : / 2 + / - 2t is a square mod 2*~ 2 , < / < 2*" 2 } 

= #2{/ : I 2 + Z - 2t is a square mod 2*" 2 , < Z < 2*" 2 , Z odd}. (A. 12) 

If Z is odd, then Z^ 1 exists. Note that if Z 2 + Z — 2t = c 2 mod 2*~ 2 , then multiplying by 
Z _1 yields 1 + Z" 1 + 2Z~ 2 t = Z~ 2 c, which is also a square mod 2*~ 2 . Hence 

#{Z : 1 + Z" 1 - 2Z~ 2 t is a square mod 2*" 2 , < Z < 2 <_2 , Z odd}. (A. 13) 

Since 1 + Z _1 + 2Z _2 t is even and a square, 1 + Z _1 + 2Z~ 2 t = 4m 2 mod 2' -2 for some 
m, < m < 2*~ 4 . Therefore 

#{Z : Z 2 + Z - 2t is a square mod 2*" 2 , < Z < 2 t_1 , Z odd} = #{A; 2 mod 2*" 4 }; 

(A. 14) 

the proof of this case is completed by Proposition [A3] □ 
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A.4. Proof of Lemma 

Proof of Lemma \14\ Suppose / G ^^(ajp*). Then 0~^J = 1 an d 

Z=0,(Z 2 -a,p)=l V V V J 

-£ £ // (/ + fcp) 2 -a 

^ fc=0 l=0,l 2 ^a mod p ^ ^ ^ 




1+ £ 1 (A.15) 



l=0,l 2 j^a mod p 

as (see for example page 63 of lURl ) 

p=1 /p 



i=0 

Substituting 



i=0 
l^^a mod p 



i 



into (IA.15I) gives us the desired result. □ 

A. 5. Proof of Lemma 1331 We use the following fact in our proof. 

Proposition A.3 (Stangl (St]|). Let p be an odd prime. Then 

modp i } = ^ T + (-l) 

When p = 2, we have that 



P t+1 _i_ f 1H-1 P-1 i 3 
2(p+l) ^ 1 ' 4(p+l) ^ 4' 



#{fc 2 mod 2 4 } = + *=£± + |. 



Proof. As = — 1, the congruence x 2 — a = mod p has no solutions. Therefore 

#^(a;p*)=0. 

For the other claim, let fc G S'^a-.p 1 ) and assume fjjM = 1. Then A; 2 
p 2 m 2 mod p l for some m, < m < p l ~ 2 . We have two cases. 



a 



Case 1 : Suppose t < 2. In this case, we have m = 0, and since the congruence 
x 2 = a mod p l has exactly 2 solutions, we conclude that ftS'^a; p l ) = 2. 

Case 2: Suppose t > 3. Consider 

: S^ajp*) -»■ {m 2 modp'~ 2 } (A.18) 
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defined by g(k) = m 2 . By Proposition IA.2[ for each m 2 G {m 2 modp'~ 2 }, the con- 
gruence x 2 = p 2 m 2 + a mod p* is solvable with precisely two solutions. Hence g is 
surjective and each element in the image of g has exactly two distinct element in its 
pre-image. Therefore, since j^S'^a-^p 1 ) = #{m 2 modp' -2 }, by Theorem lA.3l we are 
done. □ 
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